Vulnarycritical

the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

2,076critical tracked/77new today/63known-exploited/0exploit available/2,076critical tracked/77new today/63known-exploited/0exploit available/2,076critical tracked/77new today/63known-exploited/0exploit available/2,076critical tracked/77new today/63known-exploited/0exploit available/

The feed (latest)

2,076 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2023-54184

A critical bug in the Linux kernel’s iSCSI target module can cause a use‑after‑free and a NULL pointer dereference when an iSCSI session is closed. The flaw could allow an attacker to crash the system or potentially execute arbitrary code. The kernel has already incorporated a fix that moves the cleanup of recovery entries before the session is freed.

Critical· 9.8<1% likelyfix available

published Dec 30, 2025deletes in 29d

CVE-2025-68745

A critical flaw in the Linux kernel’s qla2xxx SCSI driver caused commands to hang after a chip reset and triggered kernel crashes. The issue was fixed by reverting a recent change that mishandled DMA unmapping and by partially reverting another change that mishandled port and host resets. The fix is now included in the kernel source.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 24d

CVE-2025-68741

A critical flaw in the Linux kernel’s SCSI driver can corrupt memory when freeing certain items. The bug occurs in the qla2xxx driver when it incorrectly frees pre‑allocated memory, potentially leading to system crashes or arbitrary code execution. The issue has been fixed in a kernel update.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 24d

CVE-2023-54094

A critical bug in the Linux kernel could corrupt packet buffers when certain network packets are processed, potentially causing system crashes. The issue arises when GRO-ed packets are segmented and written to shared packet buffers. The kernel has been patched to prevent this corruption.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 29d

CVE-2023-54090

A critical vulnerability in the Linux kernel's ixgbe driver causes a panic when handling XDP (eXpress Data Path) traffic on systems with more than 64 CPUs. The issue arises from improper indexing of XDP TX rings, leading to an out-of-bounds array access. A fix exists in a kernel patch that adjusts ring indexing logic.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 29d

CVE-2023-54076

A critical vulnerability in the Linux kernel’s SMB client could allow an attacker to trigger a use‑after‑free error, potentially leading to arbitrary code execution. The flaw occurs when the kernel fails to correctly reference SMB sessions, allowing a malicious server to free memory that the client still uses. The issue has been fixed in a kernel update.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 29d

CVE-2022-50717

A critical vulnerability in the Linux kernel’s NVMe over TCP implementation could allow an attacker to cause a memory corruption by using an out‑of‑bounds transfer tag. The issue has been fixed by adding a bounds check. Users should update to a kernel version that includes this patch.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 29d

CVE-2025-68726

A flaw in how the Linux kernel handles memory sizes within certain encryption functions can lead to system instability. Specifically, the way certain cryptographic algorithms manage request sizes can cause memory corruption.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 24d

CVE-2025-68359

A critical bug in the Linux kernel’s Btrfs filesystem could cause a double free of a qgroup record, potentially crashing the system. The flaw occurs when adding a delayed reference head fails after the record was already reported to exist. The issue has been fixed in the kernel code.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 24d

CVE-2023-53996

A critical flaw in the Linux kernel’s SEV (Secure Encrypted Virtualization) handling could corrupt memory during live migration. The bug caused pages to be incorrectly marked as decrypted when addresses were not page‑aligned, leading to data corruption. The issue has been fixed in newer kernel releases.

Critical· 9.3<1% likelyfix available

published Dec 24, 2025deletes in 29d

CVE-2023-53867

A critical bug in the Linux kernel’s Ceph module could cause a program to crash when it tries to use a freed memory block. The flaw occurs while trimming session capabilities, potentially leading to a use‑after‑free crash. The issue has been fixed in the kernel source.

Critical· 9.8<1% likelyfix available

published Dec 24, 2025deletes in 29d

CVE-2025-68341

A race condition vulnerability exists in the Linux kernel's veth component. This flaw occurs when multiple processes attempt to use the same BPF network context simultaneously, potentially leading to unexpected behavior.

Critical· 9.8<1% likelyfix available

published Dec 23, 2025deletes in 24d

CVE-2025-68315

CVE-2025-68315 is a critical vulnerability in the Linux kernel's f2fs filesystem where a potential corruption in the free_nid_list could be exploited. The fix involves adding a sanity check in f2fs_alloc_nid() to detect invalid inode/nid values.

Critical· 9.8<1% likelyfix available

published Dec 16, 2025deletes in 24d

CVE-2025-68301

A critical bug in the Linux kernel's atlantic driver can cause a kernel crash when it receives packets with too many fragments. The flaw allows an out-of-bounds write that leads to a kernel panic. The issue has been fixed in a recent kernel update.

Critical· 9.8<1% likelyfix available

published Dec 16, 2025deletes in 24d

CVE-2025-68285

A flaw in the Linux kernel's Ceph component allows for a 'use-after-free' error. This occurs when the system tries to access memory that has already been released, specifically during the handling of monitor or OSD maps.

Critical· 9.8<1% likelyfix available

published Dec 16, 2025deletes in 24d

CVE-2025-68284

A critical vulnerability in the Linux kernel’s libceph component could allow attackers to write outside intended memory bounds when processing authentication data from untrusted network packets. The issue has been fixed by adding boundary checks in the handle_auth_session_key() function. Users should update to a kernel version that includes this patch.

Critical· 9.8<1% likelyfix available

published Dec 16, 2025deletes in 24d

CVE-2025-68192

A flaw in the Linux kernel's USB networking component causes the system to fail to properly initialize certain data headers. This error occurs when processing raw IP packets through specific interfaces.

Critical· 9.8<1% likelyfix available

published Dec 16, 2025deletes in 24d

CVE-2025-40350

The Linux kernel’s mlx5e driver incorrectly builds socket buffers when XDP programs change the layout of an xdp_buff, which can lead to kernel warnings or crashes. The issue has been fixed in the kernel source.

Critical· 9.8<1% likelyfix available

published Dec 16, 2025deletes in 24d